Subject: RE: [mobile-ip] Protecting the MN-HA signaling with IPsec

From: [email-masked]
Date: Thu, 26 Sep 2002 16:15:11 +0300

Francis Dupont wrote:
>    Naturally each MN should have a 
>    separate SA, but the SPI field should be enough to 
> multiplex them. If 
>    this is possible, then the HA's incoming SA would just 
> ignore the source 
>    address, and would thus work from any address (home 
> address, care-of 
>    address, new care-of address, etc.).
> 
> => this argument applies to tunnels and in these cases the address is
> the outer one (which should not be checked according to RFC 2401 even
> if many implementations are too paranoid about this point).
> 

So this would work if the MN-HA signaling would be carried within the MN-HA ESP tunnel (the new CoA would be the source address of the outer IPv6 header)? The tunnel is needed for HoTI/HoT protection anyway, and could be used to protect MN-HA signaling as well. Or is there some problem with this?

>    The outgoing SA could be updated 
>    by the BU the same way as is currently done for the MN-HA 
> tunnel SAs.
>    
> => unfortunately this kind of integration between IPsec and 
> Mobile IPv6
> is only available in some dreams.
> 

But this is required in your draft for MN-HA tunnel already (requirements in section 6)? Also, the operations in sections 8.x require some level of IPsec and Mobile IPv6 integration as well, or not?

	Jarno

---

From: Francis Dupont <[email-masked]>
Date: Thu, 26 Sep 2002 18:04:55 +0200

> if many implementations are too paranoid about this point).
   
   So this would work if the MN-HA signaling would be carried within
   the MN-HA ESP tunnel

=> this cannot work because the MN-HA signaling establishes the tunnel.
   
   But this is required in your draft for MN-HA tunnel already

=> no, the API is for updating the addresses of SAs, including
by a create/delete (aka rekeying in IPsec terminology).

  Also, the operations in sections 8.x require some level of IPsec and Mobile
  IPv6 integration as well, or not?
   
=> there are different levels of integration, you'd like to jump to the
highest one. Of course, we require the lowest one and expect to get more.

[email-masked]